How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?

Question

This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets.

Also, most of the persistence methods I have seen tend to be model specific & rare.

Answer 1

and having To Re-infect again after every Reboot seems so inefficient

IoT devices like modems/routers, printers, smart TV, cameras, smart light bulbs, ... rarely restart. Most times they are running and even if seemingly switched off they are at most put into some kind of stand-by, since it is expected they react to remote control, new printing jobs etc. Also, such botnets often continuously propagate by scanning the internet for not-infected devices. Thus any vulnerable device which got rebooted might be quickly reinfected.

Answer 2

If you look at Mirai for example it has a loader tool to enable a kind of persistence. So when the scanner gets a successful login (new bot) it will add the ip, username & password to the sql database of bots. Then periodically the loader will run through this list and if any bot is not online then it will login and redownload Mirai to add it to the botnet. But also as pointed out these bots scan many thousands of ips in a short time frame so if they are still using weak credentials or vulnerable software then it will be quickly readded to the botnet.